Question

I have got two methods in application_controller.rb

def force_ssl
      if !request.ssl?
        redirect_to :protocol => 'https'
      end
    end

    def no_ssl
      if request.ssl?
        redirect_to :protocol => "http"
      end
    end

also I have done before_filter :no_ssl in application.rb

Now I am trying to call force_ssl method in sessions controller of devise to secure login through SSL

In sessions_controller.rb file I have done skip_before_filter :no_ssl and before_filter :force_ssl

I am not able to login when I use this, however if I do not do before_filter :no_ssl in application_controller.rb it works fine.

Since I have got lot of controller I was trying to put before_filter :no_ssl in application.rb so that I do not have to call before_filter :no_ssl in all the controllers as it will not be DRY.

I have tried almost all the available resources and dont know why this is not working.

P.S :- This is working for my other controllers except for the devise controller
Any suggestions??

Thanks,

Answer 1

1. You can use Bartt-SSL_Requirement, it works well in Rails 3.1, that way you don’t need the before_filter and skip_before_filter. In BarttSSLRequirement you can use the “ssl_exceptions” for your before_filter needs.

2. SSL sometimes gives problems in Development, push it to staging and it should work.